What is Privacy? Steven M. Bellovin February 12,

Transcription

1 What is Privacy? Steven M. Bellovin February 12,

2 What is Privacy? Warren and Brandeis (1890): the right to be let alone (They were trying to find a legal rationale to protect privacy under then-existing statutes and principles.) FIPS PUB 41: The right of an entity... to determine the degree to which it will interact with its environment, including the degree to which the entity is willing to share its personal information with others OSI: The right of individuals to control or influence what information related to them may be collected and stored and by whom and to whom that information may be disclosed Steven M. Bellovin February 12,

3 Using versus Gathering The primary concern is how information is used Obtaining information is often much less of a concern Note, though, that a lot of personal information is considered private even from one other person Steven M. Bellovin February 12,

4 Legal Foundations of Privacy Common law: [T]he house of every one is to him as his castle and fortress. Semayne s Case, 5 C. Rep. 91a, 77 Eng. Rep. 194 (K.B. 1603) Doesn t work as well in today s interconnected world Information is collected, stored, analyzed Steven M. Bellovin February 12,

5 The Role of Computers Computers make mass storage (more) feasible (Punch card storage (1880s) started the process) Computers allow for rapid, sophisticated matching and correlation Computers can make inferences and predictions, and group people into categories Steven M. Bellovin February 12,

6 Inferences Amazon, Netflix, etc., try to predict what else you might like These algorithms work by correlation Often, they re right, but sometimes, they give odd results... Steven M. Bellovin February 12,

7 Amazon s Recommendation Steven M. Bellovin February 12,

8 Why Violate Privacy? Thoughtlessness Efficiency, especially for marketing New markets (i.e., new location-based offerings) Public safety and national security Steven M. Bellovin February 12,

9 How Do We Lose Privacy? Voluntarily Compulsion Reuse of data This sort of secondary use is the source of most privacy violations Steven M. Bellovin February 12,

10 Voluntary Surrender of Data Social networking sites Purchases (Netflix, Amazon) Warranty cards Steven M. Bellovin February 12,

11 Compulsion Various interactions with governments (marriage, property purchases, etc.) Boarding an airplane Contracts e.g., getting a credit card in exchange for information Steven M. Bellovin February 12,

12 Secondary Use We may not object or object too much to the initial collection of certain data Often, we benefit from the initial collection, and hence regard it as a fair trade When it is used for another purpose without our knowledge or consent, trouble often results Steven M. Bellovin February 12,

13 Example: Bars and Drivers Licenses Many bars use swipe readers to verify that the proferred license is genuine (Better-grade fakes have mag stripe data anyway... ) But the readers copy the data: name, address, gender, etc. Steven M. Bellovin February 12,

14 What are the Privacy Violations? Using license data to establish age Using license data for marketing Steven M. Bellovin February 12,

15 Data on a Driver s License Primary purpose: certification that you are legally allowed to drive Primary purpose of picture: assurance that the bearer is indeed the license holder Demographic data: accountability in event of violations Not intended for proof of age, not intended as an airplane boarding credential Steven M. Bellovin February 12,

16 Age Verification Even if age verification is acceptable and use of licenses for that is certainly accepted by the states use of the additional data for marketing is not Resale of license data happens to be illegal, but not for that reason Steven M. Bellovin February 12,

17 Example: MetroCard Primary purpose: paying subway or bus fare But the MTA retains your trip information This data can be and has been used for criminal and divorce cases Steven M. Bellovin February 12,

18 The London Oyster Card Steven M. Bellovin February 12,

19 Linkages Sometimes, items from two or more databases are linked Then possible to learn much more Prerequisite: common data item Steven M. Bellovin February 12,

20 Linkages: MetroCard How did you pay for your last MetroCard? Credit card? That links the MetroCard to a person Query: who boarded the subway at 116th and Broadway between 3:30 and 3:45 AM last Tuesday? In principle, at least, that question may be answerable Steven M. Bellovin February 12,

21 Deeper Linkages Correlate on patterns Example: assume a MetroCard is used infrequently, but at only two stops, Penn Station and 116th St Is there any one person who used a credit card to buy train (Amtrak, NJ Transit, LIRR) tickets on just those days? (Note: I have no idea if that has actually been done) Steven M. Bellovin February 12,

22 Identity Sometimes, anonymous data can be linked to a specific person Other times, behavior identifies you Linkages can be used to establish identity MetroCards are anonymous but credit cards aren t Steven M. Bellovin February 12,

23 Authentication If you re an authenticated user, your behavior can be tracked more easily over time (This includes Google, many media sites, etc.) Sometimes, even free accounts ask for demographic information, to improve profiles and ad targeting Steven M. Bellovin February 12,

24 On the Internet, Nobody Knows You re a Dog (Famous New Yorker cartoon) Often, what matters is not who you are, but what you do Example: for targeted ads, your identity doesn t matter, your interests do Steven M. Bellovin February 12,

25 Online and Offline You re profiled online and in the physical world Sometimes, the two are linked Profiling isn t new but people have gotten a lot better at it Steven M. Bellovin February 12,

26 Offline Credit reports Credit card purchases Loyalty card programs Magazine subscriptions Warranty cards Public data (e.g., mortgages) Zip code demographics Steven M. Bellovin February 12,

27 Online Cookies Flash local storage Third-party ad sites Wireless ISP tracking headers Steven M. Bellovin February 12,

28 What s a Cookie? Small text file stored on your computer Set by a site; sent back to it next time you visit True but frequently used to track you Persistent identifier, retained across sessions Not necessarily linked to a particular person but the same each time you come back Linked to particular sites; one site can t retrieve another site s cookies Steven M. Bellovin February 12,

29 Good Uses for Cookies Login data Site preferences (Sometimes) shopping cart information Steven M. Bellovin February 12,

30 What Your Browser Reveals Ordinary: Advanced: (Visit these sites on your own) Steven M. Bellovin February 12,

31 Safari Headers Steven M. Bellovin February 12,

32 Chromebook Headers Steven M. Bellovin February 12,

33 Firefox Headers Steven M. Bellovin February 12,

34 Tor Headers Steven M. Bellovin February 12,

35 Panopticlick Browsers leak lots of information Computers differ subtly from each other How much information is leaked? The EFF measured it with Panopticlick Steven M. Bellovin February 12,

36 Panopticlick: Safari Steven M. Bellovin February 12,

37 Panopticlick: Firefox Steven M. Bellovin February 12,

38 Panopticlick: Tor Steven M. Bellovin February 12,

39 Third-Party Ad Sites Most ads on the web come from third parties, not the site you re visiting These third-party sites have their own cookies, which they set and receive If an ad site places content on multiple pages, they ll know which of those pages you visit; this lets them build up a very complete profile of your interests Sometimes, sites pass extra information about you to the ad providers One of the biggest ad providers is Doubleclick, which is owned by Google... Steven M. Bellovin February 12,

40 Federated Authentication Rather than requiring everyone to have a login on every site, use your Google or Facebook login to authenticate to other places Convenient many fewer passwords to enter, remember, etc. But Google, Facebook, etc., know what other sites you visit (Also security issues, but out of scope for this class) Steven M. Bellovin February 12,

41 Media Sites Many media sites, including at least the New York Times and the Wall Street Journal, track what types of articles you read This information is used for targeted advertising Steven M. Bellovin February 12,

42 Linking Online and Offline Online, it s easy to build a good profile of people If you buy something online, that site knows your name Use third-party cookies to associate your interest profile with a name Steven M. Bellovin February 12,

43 Credit Cards Most people have only a few credit cards If you use the same card for online and offline purchases, your physical person in a store can be linked to online behavior Special features have been put into some online payment protocols to facilitate this Steven M. Bellovin February 12,

44 Profiling: Good or Bad? Good: you see only ads you re interested in Bad: profiling is unpleasant. Besides, if you see interesting ads you re more likely to buy... Steven M. Bellovin February 12,

45 Fair Information Practices First code of fair information practices developed in 1973 at HEW Basic rules for minimizing information collection, ensuring due process, protection against secret collection, provide security, ensure accountability Emphasize individual knowledge and consent Principles are broadly accepted (and form the basis of privacy law in the EU and many other places), but individual principles not implemented uniformly Steven M. Bellovin February 12,

46 Fair Information Principles and Practices (FIPP) Collection limitation Data quality Purpose specification Use limitation Security Openness/notice Individual participation Accountability Steven M. Bellovin February 12,

47 Safe Harbor The EU enshrines the FIPP into law (next class... ), and bars export of data to countries that don t protect data well For the private sector, the US for the most part does not What about US companies doing business in Europe, but with data centers in the US? The old Safe Harbor provision let US companies store EU data if they promised compliance and if their promise was legally enforceable In the wake of the Snowden revelations, the ECJ invalidated Safe Harbor in October 2015 The new Privacy Shield program has replaced it Steven M. Bellovin February 12,